Control | AIE Rules & Alarms | Investigations | Summary Reports |
---|
AC-2 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Unknown User Account Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: Vulnerability Detected Summary |
AC-6 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-7 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Distributed Brute Force CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Excessive Authentication Failure Inv | CCF: Access Failure Summary CCF: Audit Log Summary CCF: Auth Failure Summary |
AC-10 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-16 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AC-17 | CCF: Abnormal Origin Location CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Non-Encrypted Protocol Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-18 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-20 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AC-21 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Social Media Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Social Media Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-23 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AC-24 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Non-Encrypted Protocol Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AC-25 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Non-Encrypted Protocol Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AU-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AU-4 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Critical Environment Error Inv CCF: Time Sync Error Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Critical Environment Error Summary CCF: Time Sync Error Summary |
AU-5 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Patch Activity Inv CCF: Signature Activity Inv CCF: Time Sync Error Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Patch Activity Summary CCF: Signature Activity Summary CCF: Time Sync Error Summary |
AU-6 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AU-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AU-8 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Modified CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Time Sync Error Inv | CCF: Audit Log Summary CCF: Time Sync Error Summary |
AU-9 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Physical Access Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary |
AU-10 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Social Media Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AU-11 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary |
AU-12 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AU-13 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Social Media Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Social Media Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
AU-14 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
AU-15 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
CA-2 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Non-Encrypted Protocol Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
CA-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
CM-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
CM-5 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
CM-6 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
CM-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
CM-8 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Patch Activity Inv CCF: Signature Activity Inv | CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Signature Activity Summary |
CM-11 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Patch Activity Inv CCF: Signature Activity Inv | CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Signature Activity Summary |
CM-12 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
CP-6 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm | CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary |
CP-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
CP-9 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm | CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Physical Access Inv CCF: Time Sync Error Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: User Object Access Summary |
CP-13 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
IA-2 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-5 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-8 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-9 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IP-2 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-10 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IP-4 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IA-12 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
IP-3 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm | CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: User Object Access Inv | CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary |
IR-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
IR-5 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
IR-6 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
IR-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
IR-9 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
IR-10 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
MA-2 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Windows RunAs Privilege Escalation | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Suspicious Users Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Top Suspicious Users CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MA-3 | CCF: Abnormal Amount of Data Transferred CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Windows RunAs Privilege Escalation | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Suspicious Users Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MA-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Config Change After Attack CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MA-5 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MA-6 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MP-2 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MP-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MP-6 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv | CCF: Audit Log Summary CCF: LogRhythm Data Loss Defender Log Summary |
PA-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MP-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
MP-8 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PA-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PE-2 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PE-3 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PE-4 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PE-5 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PE-6 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PE-7 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PE-8 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Physical Access Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Physical Access Summary |
PL-4 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PE-17 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PL-8 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
PL-9 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
PM-14 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Time Sync Error Inv | CCF: Audit Log Summary CCF: Time Sync Error Summary |
PM-6 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
PM-12 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
PM-17 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
PM-23 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary |
PM-26 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
PS-4 | CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Unknown User Account Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PS-5 | CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Unknown User Account Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PS-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Social Media Inv CCF: Unknown User Account Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Social Media Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
PS-8 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
RA-2 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
RA-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
RA-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SA-3 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Patch Activity Inv CCF: Signature Activity Inv | CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Patch Activity Summary CCF: Signature Activity Summary |
SA-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Uninstall Rule CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SA-5 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Software Install Rule CCF: Software Uninstall Rule CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Unknown User Account Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SA-9 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SA-10 | CCF: Abnormal Amount of Data Transferred CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Blacklisted Account Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Excessive Authentication Failure Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SA-18 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SA-19 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SC-2 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SC-3 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SC-4 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SC-5 | CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Denial Of Service Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm | CCF: Audit Log Inv CCF: Denial Of Service Inv | CCF: Audit Log Summary |
SC-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SC-8 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SC-10 | NetMon | NetMon | NetMon |
SC-13 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Use Of Non-Encrypted Protocols Inv | CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Use Of Non-Encrypted Protocols Summary |
SC-16 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Time Sync Error Alarm | CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Patch Activity Inv CCF: Signature Activity Inv CCF: Use Of Non-Encrypted Protocols Inv | CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Patch Activity Summary CCF: Signature Activity Summary CCF: Use Of Non-Encrypted Protocols Summary |
SC-18 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SC-20 | NetMon | NetMon | NetMon |
SC-21 | NetMon | NetMon | NetMon |
SC-22 | NetMon | NetMon | NetMon |
SC-23 | NetMon | NetMon | NetMon |
SC-24 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install Rule CCF: Software Uninstall Rule CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Patch Activity Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SC-26 | LogRhythm Honeypot Security Analytics Suite | LogRhythm Honeypot Security Analytics Suite | LogRhythm Honeypot Security Analytics Suite |
SC-27 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install Rule CCF: Software Uninstall Rule CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Patch Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Vulnerability Detected Summary |
SC-28 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Social Media Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Social Media Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SC-31 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install Rule CCF: Software Uninstall Rule CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Patch Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Vulnerability Detected Summary |
SC-35 | LogRhythm Honeypot Security Analytics Suite | LogRhythm Honeypot Security Analytics Suite | LogRhythm Honeypot Security Analytics Suite |
SC-36 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SC-38 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SC-40 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Non-Encrypted Protocol Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Malware Detected Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Malware Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary |
SC-41 | NetMon | | |
SI-2 | CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Failed Audit Log Write Alarm CCF: Linux sudo Privilege Escalation CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Windows RunAs Privilege Escalation | CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Patch Activity Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv | CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Patch Activity Summary CCF: Signature Activity Summary |
SI-3 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SI-4 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SI-5 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SI-6 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failure Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Deleted Account Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Object Access Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary |
SI-7 | CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary |
SI-8 | CCF: Abnormal Origin Location CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Account Anomalies CCF: Critical Event After Attack CCF: Denial Of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation | CCF: Account Modification Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Deleted Account Inv CCF: Denial Of Service Inv CCF: Disabled Account Inv CCF: Enabled Account Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Malware Detected Inv CCF: Password Modification Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: Vulnerability Detected Inv | CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Malware Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: Vulnerability Detected Summary |
SI-10 | | | |
SI-11 | CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Critical Environment Error Inv CCF: Patch Activity Inv CCF: Signature Activity Inv CCF: Time Sync Error Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Critical Environment Error Summary CCF: Patch Activity Summary CCF: Signature Activity Summary CCF: Time Sync Error Summary |
SI-12 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Social Media Event | CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Social Media Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Audit Log Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Social Media Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary |
SI-14 | CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Security Event CCF: Compromise Detected Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Critical Event After Attack CCF: Denial Of Service Alarm CCF: Distributed Brute Force CCF: Excessive Authentication Failure Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm | CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Host Access Granted And Revoked Inv CCF: Malware Detected Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: Vulnerability Detected Inv CCF: Excessive Authentication Failure Inv | CCF: Audit Log Summary CCF: Compromises Detected Summary CCF: Host Access Granted And Revoked Detail CCF: Malware Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: Vulnerability Detected Summary |
SI-15 | NetMon | NetMon | NetMon |
SI-16 | CCF: Abnormal Amount of Data Transferred CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Config/Policy Change Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Social Media Event CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm | CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Social Media Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Social Media Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary |
SI-17 | CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Critical/PRD Envir Signature Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install Rule CCF: Software Install Fail Alarm CCF: Software Uninstall Rule CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm | CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Patch Activity Inv CCF: Signature Activity Inv CCF: Time Sync Error Inv | CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Critical Environment Error Summary CCF: Patch Activity Summary CCF: Signature Activity Summary CCF: Time Sync Error Summary |
SI-18 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm | CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Audit Log Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary |
SI-19 | CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm | CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv | CCF: Audit Log Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary |